Tag Info

New answers tagged


Basically, you don't need to trust an OpenID provider: the user does. Let's compare, from the strict perspective of authentication, passwords with OpenID. Password: User: “hey, server, it's me! You know it's me because no one else knows the magic word correcthorsebatterystaple, which I told you when I created the account.” OpenID: User: “hey, server, it's ...


OAuth and OpenID don't send your password to the sites you use OAuth/OpenID providers to login with, so no. Not unless the attack is performed on the OAuth/OpenID provider and provider's servers are vulnerable to CVE-2014-0160 (The Heartbleed Bug). It is however possible, of course provided that sites you're logging into using OAuth/OpenID providers are ...

Top 50 recent answers are included